Received: by 2002:a25:ab43:0:0:0:0:0 with SMTP id u61csp268461ybi; Wed, 29 May 2019 21:02:33 -0700 (PDT) X-Google-Smtp-Source: APXvYqyLNT6tXDyeh1OY+upOtf273lzIr9wY6kZkkVAInuFmppHjOjDu6kPcpeBymHQb+T1ZT+9U X-Received: by 2002:a62:29c7:: with SMTP id p190mr1649441pfp.218.1559188953109; Wed, 29 May 2019 21:02:33 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1559188953; cv=none; d=google.com; s=arc-20160816; b=rWHv11bxaMy1f1B13q7may6zVswQSVWYDXxrRIXmwPVMeLnU+TAf0tRK2qI1hZ8t/a 9PxrlyDr1swC0c7KmjcThXfdrBHKEL4i+EEU4vKVH80zu3MHSp85ncfbs+GDCgDqGO50 ShvcusbtN1RTvSWjUkFc/En2DGdz+fc7fZb2pktXaN1jf6BhOk47pNkdRSQ6Nu8zb0RQ I7KEzrsom34iwkW85/P1dNDqvh98Lf4VD5SAB368tZz4i105CdPlX1wEwOslppX+IN2x 7Hxkf5wkVAQGKpLb7ifEqrNN4UtEE44e5MyTnVvfWIQDnDI24aIIjPTbBJOClzHrUWTl K6mg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=KKIINDT888bIHCfNKQw3adn+BxVsWkYaCQHjCrde/bc=; b=Gilz9xmF/Da20WuuUZo8tIeyPBNWnhI7u6XyVFHqs3gKwj/PaU5kkld1IgC9NWJRb2 jJIdHExTAW3PTjJd2EdFTFiXrSmuxdgqHtSBmaCMAjlE3fPxo4TQIARiMZJTCcWuyO0p vmu5HdYekRIxSYD1YbGrAHbOx5J/cB/Pp9DUUB8UKR7j+Nu2X2s6RPWK2SemgEruEdzU 2v3SjtaHj+eb/udQU68y8fJH36DSqtfTt+x3NcsxdZzZryfzDF84ZkVVwXZHWNhLUdES t/buConzUUdm8297Xp0CP+QQV+FpLO8akTTuvMWSCpPfgwZ6zEs50mjcdbHCZWFAJgzQ UQKg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gJZW3pfN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id h4si1720184pju.48.2019.05.29.21.02.16; Wed, 29 May 2019 21:02:33 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=gJZW3pfN; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726695AbfE3EAN (ORCPT + 99 others); Thu, 30 May 2019 00:00:13 -0400 Received: from mail.kernel.org ([198.145.29.99]:50856 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1731545AbfE3DS0 (ORCPT ); Wed, 29 May 2019 23:18:26 -0400 Received: from localhost (ip67-88-213-2.z213-88-67.customer.algx.net [67.88.213.2]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 370AF247BF; Thu, 30 May 2019 03:18:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1559186306; bh=PNE72Y90NjeYrdoAhrh6HuTrK0cQq448Gs2BahbnUj8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=gJZW3pfNti52oPCZocEEOqN27Nl07IMis6+G7OUS4CK4rOAXrbe9/S5HwCyDGUcMR YX8hZKP9us2UKMyXFzFNfIhQBcj/z8RvyI47UNe4455gMi4rZgXfbgdXcQ1Zqvlmex ufBgfsp1x4ciH2VmC+CZ/UzltRNiTQvzPLU/qXvY= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Dan Carpenter , Hans Verkuil , Mauro Carvalho Chehab , Sasha Levin Subject: [PATCH 4.19 221/276] media: wl128x: prevent two potential buffer overflows Date: Wed, 29 May 2019 20:06:19 -0700 Message-Id: <20190530030538.935195847@linuxfoundation.org> X-Mailer: git-send-email 2.21.0 In-Reply-To: <20190530030523.133519668@linuxfoundation.org> References: <20190530030523.133519668@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org [ Upstream commit 9c2ccc324b3a6cbc865ab8b3e1a09e93d3c8ade9 ] Smatch marks skb->data as untrusted so it warns that "evt_hdr->dlen" can copy up to 255 bytes and we only have room for two bytes. Even if this comes from the firmware and we trust it, the new policy generally is just to fix it as kernel hardenning. I can't test this code so I tried to be very conservative. I considered not allowing "evt_hdr->dlen == 1" because it doesn't initialize the whole variable but in the end I decided to allow it and manually initialized "asic_id" and "asic_ver" to zero. Fixes: e8454ff7b9a4 ("[media] drivers:media:radio: wl128x: FM Driver Common sources") Signed-off-by: Dan Carpenter Signed-off-by: Hans Verkuil Signed-off-by: Mauro Carvalho Chehab Signed-off-by: Sasha Levin --- drivers/media/radio/wl128x/fmdrv_common.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/drivers/media/radio/wl128x/fmdrv_common.c b/drivers/media/radio/wl128x/fmdrv_common.c index 800d69c3f80b8..1cf4019689a56 100644 --- a/drivers/media/radio/wl128x/fmdrv_common.c +++ b/drivers/media/radio/wl128x/fmdrv_common.c @@ -489,7 +489,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8 fm_op, u16 type, void *payload, return -EIO; } /* Send response data to caller */ - if (response != NULL && response_len != NULL && evt_hdr->dlen) { + if (response != NULL && response_len != NULL && evt_hdr->dlen && + evt_hdr->dlen <= payload_len) { /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); memcpy(response, skb->data, evt_hdr->dlen); @@ -583,6 +584,8 @@ static void fm_irq_handle_flag_getcmd_resp(struct fmdev *fmdev) return; fm_evt_hdr = (void *)skb->data; + if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag)) + return; /* Skip header info and copy only response data */ skb_pull(skb, sizeof(struct fm_event_msg_hdr)); @@ -1308,7 +1311,7 @@ static int load_default_rx_configuration(struct fmdev *fmdev) static int fm_power_up(struct fmdev *fmdev, u8 mode) { u16 payload; - __be16 asic_id, asic_ver; + __be16 asic_id = 0, asic_ver = 0; int resp_len, ret; u8 fw_name[50]; -- 2.20.1